<!DOCTYPE HTML>
<html lang="en" class="navy sidebar-visible" dir="ltr">
<head>
<meta charset="UTF-8">
<title>Security - towl Documentation</title>
<meta name="description" content="Documentation for towl - a fast CLI tool to scan codebases for TODO comments">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="theme-color" content="#ffffff">
<link rel="icon" href="../favicon.svg">
<link rel="shortcut icon" href="../favicon.png">
<link rel="stylesheet" href="../css/variables.css">
<link rel="stylesheet" href="../css/general.css">
<link rel="stylesheet" href="../css/chrome.css">
<link rel="stylesheet" href="../css/print.css" media="print">
<link rel="stylesheet" href="../FontAwesome/css/font-awesome.css">
<link rel="stylesheet" href="../fonts/fonts.css">
<link rel="stylesheet" id="highlight-css" href="../highlight.css">
<link rel="stylesheet" id="tomorrow-night-css" href="../tomorrow-night.css">
<link rel="stylesheet" id="ayu-highlight-css" href="../ayu-highlight.css">
<script>
const path_to_root = "../";
const default_light_theme = "navy";
const default_dark_theme = "navy";
window.path_to_searchindex_js = "../searchindex.js";
</script>
<script src="../toc.js"></script>
</head>
<body>
<div id="mdbook-help-container">
<div id="mdbook-help-popup">
<h2 class="mdbook-help-title">Keyboard shortcuts</h2>
<div>
<p>Press <kbd>←</kbd> or <kbd>→</kbd> to navigate between chapters</p>
<p>Press <kbd>S</kbd> or <kbd>/</kbd> to search in the book</p>
<p>Press <kbd>?</kbd> to show this help</p>
<p>Press <kbd>Esc</kbd> to hide this help</p>
</div>
</div>
</div>
<div id="body-container">
<script>
try {
let theme = localStorage.getItem('mdbook-theme');
let sidebar = localStorage.getItem('mdbook-sidebar');
if (theme.startsWith('"') && theme.endsWith('"')) {
localStorage.setItem('mdbook-theme', theme.slice(1, theme.length - 1));
}
if (sidebar.startsWith('"') && sidebar.endsWith('"')) {
localStorage.setItem('mdbook-sidebar', sidebar.slice(1, sidebar.length - 1));
}
} catch (e) { }
</script>
<script>
const default_theme = window.matchMedia("(prefers-color-scheme: dark)").matches ? default_dark_theme : default_light_theme;
let theme;
try { theme = localStorage.getItem('mdbook-theme'); } catch(e) { }
if (theme === null || theme === undefined) { theme = default_theme; }
const html = document.documentElement;
html.classList.remove('navy')
html.classList.add(theme);
html.classList.add("js");
</script>
<input type="checkbox" id="sidebar-toggle-anchor" class="hidden">
<script>
let sidebar = null;
const sidebar_toggle = document.getElementById("sidebar-toggle-anchor");
if (document.body.clientWidth >= 1080) {
try { sidebar = localStorage.getItem('mdbook-sidebar'); } catch(e) { }
sidebar = sidebar || 'visible';
} else {
sidebar = 'hidden';
sidebar_toggle.checked = false;
}
if (sidebar === 'visible') {
sidebar_toggle.checked = true;
} else {
html.classList.remove('sidebar-visible');
}
</script>
<nav id="sidebar" class="sidebar" aria-label="Table of contents">
<mdbook-sidebar-scrollbox class="sidebar-scrollbox"></mdbook-sidebar-scrollbox>
<noscript>
<iframe class="sidebar-iframe-outer" src="../toc.html"></iframe>
</noscript>
<div id="sidebar-resize-handle" class="sidebar-resize-handle">
<div class="sidebar-resize-indicator"></div>
</div>
</nav>
<div id="page-wrapper" class="page-wrapper">
<div class="page">
<div id="menu-bar-hover-placeholder"></div>
<div id="menu-bar" class="menu-bar sticky">
<div class="left-buttons">
<label id="sidebar-toggle" class="icon-button" for="sidebar-toggle-anchor" title="Toggle Table of Contents" aria-label="Toggle Table of Contents" aria-controls="sidebar">
<i class="fa fa-bars"></i>
</label>
<button id="theme-toggle" class="icon-button" type="button" title="Change theme" aria-label="Change theme" aria-haspopup="true" aria-expanded="false" aria-controls="theme-list">
<i class="fa fa-paint-brush"></i>
</button>
<ul id="theme-list" class="theme-popup" aria-label="Themes" role="menu">
<li role="none"><button role="menuitem" class="theme" id="default_theme">Auto</button></li>
<li role="none"><button role="menuitem" class="theme" id="light">Light</button></li>
<li role="none"><button role="menuitem" class="theme" id="rust">Rust</button></li>
<li role="none"><button role="menuitem" class="theme" id="coal">Coal</button></li>
<li role="none"><button role="menuitem" class="theme" id="navy">Navy</button></li>
<li role="none"><button role="menuitem" class="theme" id="ayu">Ayu</button></li>
</ul>
<button id="search-toggle" class="icon-button" type="button" title="Search (`/`)" aria-label="Toggle Searchbar" aria-expanded="false" aria-keyshortcuts="/ s" aria-controls="searchbar">
<i class="fa fa-search"></i>
</button>
</div>
<h1 class="menu-title">towl Documentation</h1>
<div class="right-buttons">
<a href="../print.html" title="Print this book" aria-label="Print this book">
<i id="print-button" class="fa fa-print"></i>
</a>
<a href="https://github.com/glottologist/towl" title="Git repository" aria-label="Git repository">
<i id="git-repository-button" class="fa fa-github"></i>
</a>
<a href="https://github.com/glottologist/towl/edit/main/docs/src/src/reference/security.md" title="Suggest an edit" aria-label="Suggest an edit" rel="edit">
<i id="git-edit-button" class="fa fa-edit"></i>
</a>
</div>
</div>
<div id="search-wrapper" class="hidden">
<form id="searchbar-outer" class="searchbar-outer">
<div class="search-wrapper">
<input type="search" id="searchbar" name="searchbar" placeholder="Search this book ..." aria-controls="searchresults-outer" aria-describedby="searchresults-header">
<div class="spinner-wrapper">
<i class="fa fa-spinner fa-spin"></i>
</div>
</div>
</form>
<div id="searchresults-outer" class="searchresults-outer hidden">
<div id="searchresults-header" class="searchresults-header"></div>
<ul id="searchresults">
</ul>
</div>
</div>
<script>
document.getElementById('sidebar-toggle').setAttribute('aria-expanded', sidebar === 'visible');
document.getElementById('sidebar').setAttribute('aria-hidden', sidebar !== 'visible');
Array.from(document.querySelectorAll('#sidebar a')).forEach(function(link) {
link.setAttribute('tabIndex', sidebar === 'visible' ? 0 : -1);
});
</script>
<div id="content" class="content">
<main>
<h1 id="security"><a class="header" href="#security">Security</a></h1>
<p>towl applies defence-in-depth across configuration, scanning, and output.</p>
<h2 id="path-traversal-protection"><a class="header" href="#path-traversal-protection">Path Traversal Protection</a></h2>
<p>All user-supplied paths are checked for <code>..</code> components before use:</p>
<ul>
<li><strong>Config paths</strong> -- <code>towl init --path</code> rejects traversal attempts</li>
<li><strong>Scan paths</strong> -- <code>towl scan <path></code> validates before walking</li>
<li><strong>Output paths</strong> -- <code>-o <path></code> is validated and symlinks are resolved</li>
</ul>
<p>The check uses <code>contains_path_traversal()</code> which inspects each path component for <code>..</code>.</p>
<h2 id="symlink-resolution"><a class="header" href="#symlink-resolution">Symlink Resolution</a></h2>
<p>Output file paths are resolved via <code>std::fs::canonicalize()</code> before writing. This prevents symlink-based escape from the intended output directory.</p>
<h2 id="resource-limits"><a class="header" href="#resource-limits">Resource Limits</a></h2>
<p>Hard limits prevent denial-of-service via large repositories or malicious inputs:</p>
<div class="table-wrapper"><table><thead><tr><th>Limit</th><th>Value</th><th>Purpose</th></tr></thead><tbody>
<tr><td>Max file size</td><td>10 MB</td><td>Prevents reading huge binary/generated files</td></tr>
<tr><td>Max TODOs per file</td><td>10,000</td><td>Bounds per-file memory usage</td></tr>
<tr><td>Max total TODOs</td><td>100,000</td><td>Bounds overall memory usage</td></tr>
<tr><td>Max files scanned</td><td>100,000</td><td>Bounds directory walk</td></tr>
<tr><td>Max pattern length</td><td>256 chars</td><td>Prevents regex DoS via long patterns</td></tr>
<tr><td>Max compiled regex</td><td>256 KB</td><td>Bounds regex engine memory</td></tr>
<tr><td>Max total patterns (combined)</td><td>50</td><td>Bounds total regex compilation across all categories</td></tr>
<tr><td>Max patterns per config field</td><td>100</td><td>Limits config file attack surface</td></tr>
</tbody></table>
</div>
<h2 id="secret-handling"><a class="header" href="#secret-handling">Secret Handling</a></h2>
<p>The GitHub token (<code>TOWL_GITHUB_TOKEN</code>) is:</p>
<ul>
<li><strong>Never stored in config files</strong> -- Only accepted via environment variable</li>
<li><strong>Stored as <code>SecretString</code></strong> -- Uses the <code>secrecy</code> crate</li>
<li><strong>Masked in debug output</strong> -- <code>Debug</code> and <code>Display</code> show <code>[REDACTED]</code></li>
<li><strong>Zeroed on drop</strong> -- Memory is cleared when the config is dropped</li>
</ul>
<h2 id="environment-variable-restriction"><a class="header" href="#environment-variable-restriction">Environment Variable Restriction</a></h2>
<p>Eight environment variables are read:</p>
<div class="table-wrapper"><table><thead><tr><th>Variable</th><th>Purpose</th></tr></thead><tbody>
<tr><td><code>TOWL_CONFIG</code></td><td>Config file path override</td></tr>
<tr><td><code>TOWL_GITHUB_TOKEN</code></td><td>GitHub authentication</td></tr>
<tr><td><code>TOWL_GITHUB_OWNER</code></td><td>Repository owner override</td></tr>
<tr><td><code>TOWL_GITHUB_REPO</code></td><td>Repository name override</td></tr>
<tr><td><code>TOWL_LLM_API_KEY</code></td><td>LLM API authentication</td></tr>
<tr><td><code>TOWL_LLM_PROVIDER</code></td><td>LLM provider override</td></tr>
<tr><td><code>TOWL_LLM_MODEL</code></td><td>LLM model override</td></tr>
<tr><td><code>TOWL_LLM_BASE_URL</code></td><td>Custom LLM endpoint URL</td></tr>
</tbody></table>
</div>
<p>Secrets (<code>TOWL_GITHUB_TOKEN</code>, <code>TOWL_LLM_API_KEY</code>) are stored as <code>SecretString</code> and never written to config files or logs. No other environment variables influence behaviour.</p>
<h2 id="config-file-safety"><a class="header" href="#config-file-safety">Config File Safety</a></h2>
<ul>
<li><strong><code>--force</code> required</strong> for overwriting existing config files</li>
<li><strong>Pattern array limits</strong> -- Each pattern field is capped at 100 entries</li>
<li><strong>Pattern length limits</strong> -- Individual regex patterns capped at 256 characters</li>
<li><strong>TOML parsing</strong> -- Uses <code>config</code> crate with <code>serde</code> for type-safe deserialization</li>
</ul>
<h2 id="git-integration"><a class="header" href="#git-integration">Git Integration</a></h2>
<ul>
<li>Git operations use <code>tokio::process::Command</code> to run <code>git</code> as a subprocess</li>
<li>Only read-only git commands are executed (<code>git remote get-url origin</code>)</li>
<li>No git credentials are accessed or stored</li>
</ul>
<h2 id="llm-cli-subprocess-safety"><a class="header" href="#llm-cli-subprocess-safety">LLM CLI Subprocess Safety</a></h2>
<p>When using <code>claude-code</code> or <code>codex</code> providers, towl spawns CLI subprocesses:</p>
<ul>
<li><strong>Command validation</strong> -- Relative paths containing <code>..</code> or non-absolute <code>/</code> are rejected</li>
<li><strong>Timeout</strong> -- CLI processes are killed after 120 seconds</li>
<li><strong>Input via stdin</strong> -- Prompts are piped through stdin, not shell arguments (prevents injection)</li>
<li><strong>Stderr capture</strong> -- CLI error output is captured and included in error messages</li>
</ul>
<h2 id="gitignore-respect"><a class="header" href="#gitignore-respect">.gitignore Respect</a></h2>
<p>The <code>ignore</code> crate automatically respects <code>.gitignore</code> rules during directory walking, preventing scanning of files the user has excluded from version control.</p>
<h2 id="error-messages"><a class="header" href="#error-messages">Error Messages</a></h2>
<p>Error messages include file paths and context for debugging but do not expose internal implementation details or sensitive data. The <code>SecretString</code> type ensures tokens cannot leak through error formatting.</p>
<h2 id="threat-model"><a class="header" href="#threat-model">Threat Model</a></h2>
<div class="table-wrapper"><table><thead><tr><th>Threat</th><th>Mitigation</th></tr></thead><tbody>
<tr><td>Path traversal via config/scan/output paths</td><td><code>..</code> component detection, symlink resolution</td></tr>
<tr><td>Regex DoS via malicious patterns</td><td>Pattern length limit (256), regex size limit (256 KB), total pattern cap (50)</td></tr>
<tr><td>Memory exhaustion via large repos</td><td>File size, TODO count, and file count limits</td></tr>
<tr><td>Token leakage</td><td><code>SecretString</code>, env-only token, masked debug</td></tr>
<tr><td>Config file overwrite</td><td><code>--force</code> flag required</td></tr>
<tr><td>Arbitrary file write via symlinks</td><td><code>canonicalize()</code> on output paths</td></tr>
<tr><td>Scanning outside intended directory</td><td><code>.gitignore</code> respect, extension filtering</td></tr>
<tr><td>CLI command injection via LLM providers</td><td>Relative path rejection, stdin piping (not shell args), 120s timeout</td></tr>
</tbody></table>
</div>
</main>
<nav class="nav-wrapper" aria-label="Page navigation">
<a rel="prev" href="../reference/architecture.html" class="mobile-nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
<i class="fa fa-angle-left"></i>
</a>
<a rel="next prefetch" href="../reference/ci-cd.html" class="mobile-nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
<i class="fa fa-angle-right"></i>
</a>
<div style="clear: both"></div>
</nav>
</div>
</div>
<nav class="nav-wide-wrapper" aria-label="Page navigation">
<a rel="prev" href="../reference/architecture.html" class="nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
<i class="fa fa-angle-left"></i>
</a>
<a rel="next prefetch" href="../reference/ci-cd.html" class="nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
<i class="fa fa-angle-right"></i>
</a>
</nav>
</div>
<script>
window.playground_copyable = true;
</script>
<script src="../elasticlunr.min.js"></script>
<script src="../mark.min.js"></script>
<script src="../searcher.js"></script>
<script src="../clipboard.min.js"></script>
<script src="../highlight.js"></script>
<script src="../book.js"></script>
</div>
</body>
</html>